GET /t/ls?sid=171000524-CA-035&dt=1409093750&gid=e16551c7-a12c-48ad-827f-290c63e27445&tz=1409100950&ln=1&os=102&bis=0&bipc=0&lc1=0&lc2=0&lc3=0&f=2182739400 HTTP/1.1

User-Agent: LiveSupport

Host: bi.softservers.net

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Wed, 27 Aug 2014 03:55:56 GMT

Content-Type: application/octet-stream

Content-Length: 0

Connection: keep-alive

content-type: text/html

....

GET /t/ls?sid=171000524-CA-035&dt=1409093751&gid=e16551c7-a12c-48ad-827f-290c63e27445&tz=1409100951&ln=1&os=102&bis=1&bipc=0&lc1=0&lc2=0&lc3=0&f=2182739400 HTTP/1.1

User-Agent: LiveSupport

Host: bi.softservers.net

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Wed, 27 Aug 2014 03:55:57 GMT

Content-Type: application/octet-stream

Content-Length: 0

Connection: keep-alive

content-type: text/html

GET /171000524/LiveSupport.exe HTTP/1.0

Host: dl.softservers.net

User-Agent: InnoTools_Downloader

HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Wed, 27 Aug 2014 03:54:50 GMT

Content-Type: application/octet-stream

Content-Length: 1503056

Last-Modified: Tue, 12 Aug 2014 13:49:09 GMT

Connection: close

ETag: "53ea1b55-16ef50"

Content-Disposition: attachment; filename=LiveSupport.exe

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................3.......................2.....................Rich............................PE..L....((S.................(...........g.......@....@.......................... ............@.....................................P.......p...............P............................................q..@............@..P............................text....'.......(.................. ..`.rdata...L...@...N...,..............@..@.data....4...........z..............@....rsrc...p...........................@..@.reloc...'.......(..................@..B........................................................................................................................................................................................................................................................................................................................................................U.........l.A.3..E.V.u.W.}.h..........j.P..;...........Qj.j.j(j...8AA.....j.........#.PWVh.AA.j...<AA.3... ..._^...M.3...;....].U...U....@$R.U.R.U.R..]............AA..:C.......U..V.....AA..$C...E..t.V..:.......^]............U..QV..j..M..:0...F....s.@.F..M..N0..^..].......U..QVW..j..M...0...G...t....s.H.G..w........M.#...0.._..^..].......AA...........U..QW.9..t;j..M.../...G...t....s.H.G.V.w......M...../..#.t.....j.....^_..]......................................U...E....u..y..r....E..U....]....y..r....M.P.

<<< skipped >>>

GET /t/op?sid=111000524-RU-112&dt=1409104544&gid=279FF228-F611-4F8E-2763-A7C83351AF9C&tz=2&ln=1&lc=0&bis=0&bief=0&biefx=0&bif=0&os=102&f=2875206911 HTTP/1.1